Even if all contributors have verified identities, sign their commits, etc it isn't enough. Consider the real-world case where a developer's laptop is hacked an

Even if all contributors have verified identities, sign their commits, etc it isn't enough. Consider the real-world case where a developer's laptop is hacked and the attacker subtly modifies their local source tree to introduce a vulnerability that is unwittingly signed and committed by that developer. I've seen cases like this in the wild caught in code review. It always made me wonder how many such cases don't get caught, since code review isn't consistently thorough.